multicast_test.go

package main

import (
	"errors"
	"io"
	"net/netip"
	"reflect"
	"testing"
	"time"

	"github.com/sirupsen/logrus"
	"github.com/slackhq/nebula"
	"github.com/slackhq/nebula/cert"
	"github.com/slackhq/nebula/config"
	"github.com/slackhq/nebula/overlay"
	"github.com/slackhq/nebula/routing"
)

func TestNewMulticastDeviceFactoryDisabledByDefault(t *testing.T) {
	c := newTestConfig(t, "---\n")

	factory, err := newMulticastDeviceFactory(c, new(*nebula.Control))
	if err != nil {
		t.Fatalf("unexpected error: %v", err)
	}
	if factory != nil {
		t.Fatal("expected nil factory when multicast is not configured")
	}
}

func TestNewMulticastDeviceFactoryEnabledRequiresGroup(t *testing.T) {
	c := newTestConfig(t, "multicast:\n  enabled: true\n")

	factory, err := newMulticastDeviceFactory(c, new(*nebula.Control))
	if err == nil {
		t.Fatal("expected error")
	}
	if factory != nil {
		t.Fatal("expected nil factory on invalid multicast config")
	}
}

func TestNewMulticastDeviceFactoryEnablesFromTagAlias(t *testing.T) {
	c := newTestConfig(t, "multicast:\n  tag: discovery\n")

	factory, err := newMulticastDeviceFactory(c, new(*nebula.Control))
	if err != nil {
		t.Fatalf("unexpected error: %v", err)
	}
	if factory == nil {
		t.Fatal("expected multicast factory from multicast.tag")
	}
}

func TestNewMulticastDeviceFactoryEnablesFromTagsAlias(t *testing.T) {
	c := newTestConfig(t, "multicast:\n  tags:\n    - discovery\n")

	factory, err := newMulticastDeviceFactory(c, new(*nebula.Control))
	if err != nil {
		t.Fatalf("unexpected error: %v", err)
	}
	if factory == nil {
		t.Fatal("expected multicast factory from multicast.tags")
	}
}

func TestMulticastTargetAddrsFiltersByGroupAndDeduplicates(t *testing.T) {
	addr1 := netip.MustParseAddr("10.0.0.2")
	addr2 := netip.MustParseAddr("10.0.0.3")
	hosts := []nebula.ControlHostInfo{
		{VpnAddrs: []netip.Addr{addr1}, Cert: fakeCert{groups: []string{"discovery"}}},
		{VpnAddrs: []netip.Addr{addr1, addr2}, Cert: fakeCert{groups: []string{"discovery", "other"}}},
		{VpnAddrs: []netip.Addr{netip.MustParseAddr("10.0.0.4")}, Cert: fakeCert{groups: []string{"ignored"}}},
		{VpnAddrs: []netip.Addr{netip.MustParseAddr("10.0.0.5")}},
	}

	got := multicastTargetAddrs(hosts, map[string]struct{}{"discovery": {}})
	want := []netip.Addr{addr1, addr2}
	if !reflect.DeepEqual(got, want) {
		t.Fatalf("targets mismatch\n got: %v\nwant: %v", got, want)
	}
}

func TestMulticastDeviceReadForwardsMulticastAndDropsOriginal(t *testing.T) {
	target := netip.MustParseAddr("10.0.0.2")
	device := newMulticastDevice(&fakeDevice{reads: [][]byte{testIPv4UDP(t, "10.0.0.1", "224.0.0.251")}}, logrus.New(), func() []netip.Addr {
		return []netip.Addr{target}
	})
	buf := make([]byte, 1500)

	n, err := device.Read(buf)
	if err != nil {
		t.Fatalf("read failed: %v", err)
	}
	got, ok := netip.AddrFromSlice(buf[16:20])
	if !ok {
		t.Fatal("failed to parse rewritten destination")
	}
	if got != target {
		t.Fatalf("destination = %v, want %v", got, target)
	}
	if isMulticastPacket(buf[:n]) {
		t.Fatal("expected returned packet to be unicast clone")
	}
}

func TestMulticastDevicePassesThroughUnicast(t *testing.T) {
	packet := testIPv4UDP(t, "10.0.0.1", "10.0.0.2")
	device := newMulticastDevice(&fakeDevice{reads: [][]byte{packet}}, logrus.New(), func() []netip.Addr {
		t.Fatal("targets should not be queried for unicast packets")
		return nil
	})
	buf := make([]byte, 1500)

	n, err := device.Read(buf)
	if err != nil {
		t.Fatalf("read failed: %v", err)
	}
	if !reflect.DeepEqual(buf[:n], packet) {
		t.Fatal("unicast packet was modified")
	}
}

func TestMulticastDeviceDisablesMultiqueue(t *testing.T) {
	device := newMulticastDevice(&fakeDevice{}, logrus.New(), nil)

	if device.SupportsMultiqueue() {
		t.Fatal("expected multicast wrapper to disable multiqueue")
	}
	if _, err := device.NewMultiQueueReader(); err == nil {
		t.Fatal("expected NewMultiQueueReader error")
	}
}

func newTestConfig(t *testing.T, raw string) *config.C {
	t.Helper()
	l := logrus.New()
	l.Out = io.Discard
	c := config.NewC(l)
	if err := c.LoadString(raw); err != nil {
		t.Fatalf("failed to load config: %v", err)
	}
	return c
}

type fakeDevice struct {
	reads [][]byte
	read  int
}

func (d *fakeDevice) Read(p []byte) (int, error) {
	if d.read >= len(d.reads) {
		return 0, io.EOF
	}
	n := copy(p, d.reads[d.read])
	d.read++
	return n, nil
}

func (d *fakeDevice) Write(p []byte) (int, error) { return len(p), nil }
func (d *fakeDevice) Close() error                { return nil }
func (d *fakeDevice) Activate() error             { return nil }
func (d *fakeDevice) Networks() []netip.Prefix    { return nil }
func (d *fakeDevice) Name() string                { return "fake0" }
func (d *fakeDevice) RoutesFor(netip.Addr) routing.Gateways {
	return nil
}
func (d *fakeDevice) SupportsMultiqueue() bool { return true }
func (d *fakeDevice) NewMultiQueueReader() (io.ReadWriteCloser, error) {
	return nil, errors.New("not implemented")
}

type fakeCert struct {
	groups []string
}

func (c fakeCert) Version() cert.Version                     { return cert.Version1 }
func (c fakeCert) Name() string                              { return "fake" }
func (c fakeCert) Networks() []netip.Prefix                  { return nil }
func (c fakeCert) UnsafeNetworks() []netip.Prefix            { return nil }
func (c fakeCert) Groups() []string                          { return c.groups }
func (c fakeCert) IsCA() bool                                { return false }
func (c fakeCert) NotBefore() time.Time                      { return time.Time{} }
func (c fakeCert) NotAfter() time.Time                       { return time.Time{} }
func (c fakeCert) Issuer() string                            { return "" }
func (c fakeCert) PublicKey() []byte                         { return nil }
func (c fakeCert) MarshalPublicKeyPEM() []byte               { return nil }
func (c fakeCert) Curve() cert.Curve                         { return cert.Curve_CURVE25519 }
func (c fakeCert) Signature() []byte                         { return nil }
func (c fakeCert) CheckSignature([]byte) bool                { return true }
func (c fakeCert) Fingerprint() (string, error)              { return "fake", nil }
func (c fakeCert) Expired(time.Time) bool                    { return false }
func (c fakeCert) VerifyPrivateKey(cert.Curve, []byte) error { return nil }
func (c fakeCert) Marshal() ([]byte, error)                  { return nil, nil }
func (c fakeCert) MarshalForHandshakes() ([]byte, error)     { return nil, nil }
func (c fakeCert) MarshalPEM() ([]byte, error)               { return nil, nil }
func (c fakeCert) MarshalJSON() ([]byte, error)              { return nil, nil }
func (c fakeCert) String() string                            { return "fake" }
func (c fakeCert) Copy() cert.Certificate                    { return c }

var _ overlay.Device = (*fakeDevice)(nil)
var _ cert.Certificate = fakeCert{}